ContentCreatorVisibleXbConfigEntityAccessControlHandler's `view` access must refuse access to disabled config entities

Overview

Discovered by @penyaskito at https://git.drupalcode.org/project/experience_builder/-/merge_requests/8...

Proposed resolution

1. Test coverage
2. Remove xb_visible_when_disabled, instead update \Drupal\experience_builder\Controller\ApiConfigControllers::list() like this:
   

   diff --git a/src/Controller/ApiConfigControllers.php b/src/Controller/ApiConfigControllers.php
   index e308597fe..783836733 100644
   --- a/src/Controller/ApiConfigControllers.php
   +++ b/src/Controller/ApiConfigControllers.php
   @@ -19,6 +19,8 @@ use Drupal\experience_builder\AssetRenderer;
    use Drupal\experience_builder\ClientSideRepresentation;
    use Drupal\experience_builder\ComponentSource\ComponentSourceInterface;
    use Drupal\experience_builder\Entity\XbHttpApiEligibleConfigEntityInterface;
   +use Drupal\experience_builder\EntityHandlers\ContentCreatorVisibleXbConfigEntityAccessControlHandler;
   +use Drupal\experience_builder\EntityHandlers\XbConfigEntityAccessControlHandler;
    use Drupal\experience_builder\Exception\ConstraintViolationException;
    use Drupal\experience_builder\Plugin\DataType\ComponentTreeStructure;
    use Drupal\experience_builder\Plugin\Field\FieldType\ComponentTreeItem;
   @@ -69,7 +71,12 @@ final class ApiConfigControllers extends ApiControllerBase {
        $storage = $this->entityTypeManager->getStorage($xb_config_entity_type_id);
        $query = $storage->getQuery()->accessCheck(TRUE);
        // Entity types can opt in to have disabled entities included in lists.
   -    if (!$xb_config_entity_type->get('xb_visible_when_disabled')) {
   +    $require_status_true = match ($xb_config_entity_type->getHandlerClass('access')) {
   +      ContentCreatorVisibleXbConfigEntityAccessControlHandler::class => FALSE,
   +      XbConfigEntityAccessControlHandler::class => TRUE,
   +      default => throw new \LogicException(),
   +    };
   +    if ($require_status_true) {
          $query->condition('status', TRUE);
        }
    

3. Tighten access control:
   

   diff --git a/src/EntityHandlers/ContentCreatorVisibleXbConfigEntityAccessControlHandler.php b/src/EntityHandlers/ContentCreatorVisibleXbConfigEntityAccessControlHandler.php
   index a1bb474b6..ed89c4324 100644
   --- a/src/EntityHandlers/ContentCreatorVisibleXbConfigEntityAccessControlHandler.php
   +++ b/src/EntityHandlers/ContentCreatorVisibleXbConfigEntityAccessControlHandler.php
   @@ -6,6 +6,7 @@ namespace Drupal\experience_builder\EntityHandlers;
    
    use Drupal\Core\Access\AccessResult;
    use Drupal\Core\Access\AccessResultInterface;
   +use Drupal\Core\Config\Entity\ConfigEntityInterface;
    use Drupal\Core\Entity\EntityHandlerInterface;
    use Drupal\Core\Entity\EntityInterface;
    use Drupal\Core\Session\AccountInterface;
   @@ -15,10 +16,10 @@ final class ContentCreatorVisibleXbConfigEntityAccessControlHandler extends XbCo
      /**
       * {@inheritdoc}
       */
   -  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account): AccessResultInterface {
   +  protected function checkAccess(ConfigEntityInterface $entity, $operation, AccountInterface $account): AccessResultInterface {
        return match($operation) {
          // We always allow viewing these entities.
   -      'view' => AccessResult::allowed(),
   +      'view' => AccessResult::allowedIf($entity->status()),
          default => parent::checkAccess($entity, $operation, $account),
        };
      }
   diff --git a/src/EntityHandlers/XbConfigEntityAccessControlHandler.php b/src/EntityHandlers/XbConfigEntityAccessControlHandler.php
   index f588d457d..828aaee88 100644
   --- a/src/EntityHandlers/XbConfigEntityAccessControlHandler.php
   +++ b/src/EntityHandlers/XbConfigEntityAccessControlHandler.php
   @@ -7,6 +7,7 @@ namespace Drupal\experience_builder\EntityHandlers;
    use Drupal\Core\Access\AccessResult;
    use Drupal\Core\Access\AccessResultInterface;
    use Drupal\Core\Config\ConfigManagerInterface;
   +use Drupal\Core\Config\Entity\ConfigEntityInterface;
    use Drupal\Core\Entity\EntityAccessControlHandler;
    use Drupal\Core\Entity\EntityHandlerInterface;
    use Drupal\Core\Entity\EntityInterface;
   @@ -34,7 +35,7 @@ class XbConfigEntityAccessControlHandler extends EntityAccessControlHandler impl
      /**
       * {@inheritdoc}
       */
   -  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account): AccessResultInterface {
   +  protected function checkAccess(ConfigEntityInterface $entity, $operation, AccountInterface $account): AccessResultInterface {
        $adminPermission = $this->entityType->getAdminPermission();
        assert(is_string($adminPermission));
        return match($operation) {
   

   User interface changes